summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--meta/recipes-connectivity/avahi/avahi_0.8.bb1
-rw-r--r--meta/recipes-connectivity/avahi/files/CVE-2024-52615.patch228
2 files changed, 229 insertions, 0 deletions
diff --git a/meta/recipes-connectivity/avahi/avahi_0.8.bb b/meta/recipes-connectivity/avahi/avahi_0.8.bb
index b3739ad2c0..20b2791ef3 100644
--- a/meta/recipes-connectivity/avahi/avahi_0.8.bb
+++ b/meta/recipes-connectivity/avahi/avahi_0.8.bb
@@ -36,6 +36,7 @@ SRC_URI = "https://github.com/lathiat/avahi/releases/download/v${PV}/avahi-${PV}
36 file://CVE-2023-38472.patch \ 36 file://CVE-2023-38472.patch \
37 file://CVE-2023-38473.patch \ 37 file://CVE-2023-38473.patch \
38 file://CVE-2024-52616.patch \ 38 file://CVE-2024-52616.patch \
39 file://CVE-2024-52615.patch \
39 " 40 "
40 41
41UPSTREAM_CHECK_URI = "https://github.com/lathiat/avahi/releases/" 42UPSTREAM_CHECK_URI = "https://github.com/lathiat/avahi/releases/"
diff --git a/meta/recipes-connectivity/avahi/files/CVE-2024-52615.patch b/meta/recipes-connectivity/avahi/files/CVE-2024-52615.patch
new file mode 100644
index 0000000000..9737f52837
--- /dev/null
+++ b/meta/recipes-connectivity/avahi/files/CVE-2024-52615.patch
@@ -0,0 +1,228 @@
1From 4e2e1ea0908d7e6ad7f38ae04fdcdf2411f8b942 Mon Sep 17 00:00:00 2001
2From: Michal Sekletar <msekleta@redhat.com>
3Date: Wed, 27 Nov 2024 18:07:32 +0100
4Subject: [PATCH] core/wide-area: fix for CVE-2024-52615
5
6CVE: CVE-2024-52615
7Upstream-Status: Backport [https://github.com/avahi/avahi/commit/4e2e1ea0908d7e6ad7f38ae04fdcdf2411f8b942]
8
9Signed-off-by: Zhang Peng <peng.zhang1.cn@windriver.com>
10---
11 avahi-core/wide-area.c | 128 ++++++++++++++++++++++-------------------
12 1 file changed, 69 insertions(+), 59 deletions(-)
13
14diff --git a/avahi-core/wide-area.c b/avahi-core/wide-area.c
15index 00a15056e..06df7afc6 100644
16--- a/avahi-core/wide-area.c
17+++ b/avahi-core/wide-area.c
18@@ -81,6 +81,10 @@ struct AvahiWideAreaLookup {
19
20 AvahiAddress dns_server_used;
21
22+ int fd;
23+ AvahiWatch *watch;
24+ AvahiProtocol proto;
25+
26 AVAHI_LLIST_FIELDS(AvahiWideAreaLookup, lookups);
27 AVAHI_LLIST_FIELDS(AvahiWideAreaLookup, by_key);
28 };
29@@ -88,9 +92,6 @@ struct AvahiWideAreaLookup {
30 struct AvahiWideAreaLookupEngine {
31 AvahiServer *server;
32
33- int fd_ipv4, fd_ipv6;
34- AvahiWatch *watch_ipv4, *watch_ipv6;
35-
36 /* Cache */
37 AVAHI_LLIST_HEAD(AvahiWideAreaCacheEntry, cache);
38 AvahiHashmap *cache_by_key;
39@@ -125,35 +126,67 @@ static AvahiWideAreaLookup* find_lookup(AvahiWideAreaLookupEngine *e, uint16_t i
40 return l;
41 }
42
43+static void socket_event(AVAHI_GCC_UNUSED AvahiWatch *w, int fd, AVAHI_GCC_UNUSED AvahiWatchEvent events, void *userdata);
44+
45 static int send_to_dns_server(AvahiWideAreaLookup *l, AvahiDnsPacket *p) {
46+ AvahiWideAreaLookupEngine *e;
47 AvahiAddress *a;
48+ AvahiServer *s;
49+ AvahiWatch *w;
50+ int r;
51
52 assert(l);
53 assert(p);
54
55- if (l->engine->n_dns_servers <= 0)
56+ e = l->engine;
57+ assert(e);
58+
59+ s = e->server;
60+ assert(s);
61+
62+ if (e->n_dns_servers <= 0)
63 return -1;
64
65- assert(l->engine->current_dns_server < l->engine->n_dns_servers);
66+ assert(e->current_dns_server < e->n_dns_servers);
67
68- a = &l->engine->dns_servers[l->engine->current_dns_server];
69+ a = &e->dns_servers[e->current_dns_server];
70 l->dns_server_used = *a;
71
72- if (a->proto == AVAHI_PROTO_INET) {
73+ if (l->fd >= 0) {
74+ /* We are reusing lookup object and sending packet to another server so let's cleanup before we establish connection to new server. */
75+ s->poll_api->watch_free(l->watch);
76+ l->watch = NULL;
77
78- if (l->engine->fd_ipv4 < 0)
79- return -1;
80+ close(l->fd);
81+ l->fd = -EBADF;
82+ }
83
84- return avahi_send_dns_packet_ipv4(l->engine->fd_ipv4, AVAHI_IF_UNSPEC, p, NULL, &a->data.ipv4, AVAHI_DNS_PORT);
85+ assert(a->proto == AVAHI_PROTO_INET || a->proto == AVAHI_PROTO_INET6);
86
87- } else {
88- assert(a->proto == AVAHI_PROTO_INET6);
89+ if (a->proto == AVAHI_PROTO_INET)
90+ r = s->config.use_ipv4 ? avahi_open_unicast_socket_ipv4() : -1;
91+ else
92+ r = s->config.use_ipv6 ? avahi_open_unicast_socket_ipv6() : -1;
93
94- if (l->engine->fd_ipv6 < 0)
95- return -1;
96+ if (r < 0) {
97+ avahi_log_error(__FILE__ ": Failed to create socket for wide area lookup");
98+ return -1;
99+ }
100
101- return avahi_send_dns_packet_ipv6(l->engine->fd_ipv6, AVAHI_IF_UNSPEC, p, NULL, &a->data.ipv6, AVAHI_DNS_PORT);
102+ w = s->poll_api->watch_new(s->poll_api, r, AVAHI_WATCH_IN, socket_event, l);
103+ if (!w) {
104+ close(r);
105+ avahi_log_error(__FILE__ ": Failed to create socket watch for wide area lookup");
106+ return -1;
107 }
108+
109+ l->fd = r;
110+ l->watch = w;
111+ l->proto = a->proto;
112+
113+ return a->proto == AVAHI_PROTO_INET ?
114+ avahi_send_dns_packet_ipv4(l->fd, AVAHI_IF_UNSPEC, p, NULL, &a->data.ipv4, AVAHI_DNS_PORT):
115+ avahi_send_dns_packet_ipv6(l->fd, AVAHI_IF_UNSPEC, p, NULL, &a->data.ipv6, AVAHI_DNS_PORT);
116 }
117
118 static void next_dns_server(AvahiWideAreaLookupEngine *e) {
119@@ -246,6 +279,9 @@ AvahiWideAreaLookup *avahi_wide_area_lookup_new(
120 l->dead = 0;
121 l->key = avahi_key_ref(key);
122 l->cname_key = avahi_key_new_cname(l->key);
123+ l->fd = -EBADF;
124+ l->watch = NULL;
125+ l->proto = AVAHI_PROTO_UNSPEC;
126 l->callback = callback;
127 l->userdata = userdata;
128
129@@ -314,6 +350,12 @@ static void lookup_destroy(AvahiWideAreaLookup *l) {
130 if (l->cname_key)
131 avahi_key_unref(l->cname_key);
132
133+ if (l->watch)
134+ l->engine->server->poll_api->watch_free(l->watch);
135+
136+ if (l->fd >= 0)
137+ close(l->fd);
138+
139 avahi_free(l);
140 }
141
142@@ -572,14 +614,20 @@ static void handle_packet(AvahiWideAreaLookupEngine *e, AvahiDnsPacket *p) {
143 }
144
145 static void socket_event(AVAHI_GCC_UNUSED AvahiWatch *w, int fd, AVAHI_GCC_UNUSED AvahiWatchEvent events, void *userdata) {
146- AvahiWideAreaLookupEngine *e = userdata;
147+ AvahiWideAreaLookup *l = userdata;
148+ AvahiWideAreaLookupEngine *e = l->engine;
149 AvahiDnsPacket *p = NULL;
150
151- if (fd == e->fd_ipv4)
152- p = avahi_recv_dns_packet_ipv4(e->fd_ipv4, NULL, NULL, NULL, NULL, NULL);
153+ assert(l);
154+ assert(e);
155+ assert(l->fd == fd);
156+
157+ if (l->proto == AVAHI_PROTO_INET)
158+ p = avahi_recv_dns_packet_ipv4(l->fd, NULL, NULL, NULL, NULL, NULL);
159 else {
160- assert(fd == e->fd_ipv6);
161- p = avahi_recv_dns_packet_ipv6(e->fd_ipv6, NULL, NULL, NULL, NULL, NULL);
162+ assert(l->proto == AVAHI_PROTO_INET6);
163+
164+ p = avahi_recv_dns_packet_ipv6(l->fd, NULL, NULL, NULL, NULL, NULL);
165 }
166
167 if (p) {
168@@ -598,32 +646,6 @@ AvahiWideAreaLookupEngine *avahi_wide_area_engine_new(AvahiServer *s) {
169 e->server = s;
170 e->cleanup_dead = 0;
171
172- /* Create sockets */
173- e->fd_ipv4 = s->config.use_ipv4 ? avahi_open_unicast_socket_ipv4() : -1;
174- e->fd_ipv6 = s->config.use_ipv6 ? avahi_open_unicast_socket_ipv6() : -1;
175-
176- if (e->fd_ipv4 < 0 && e->fd_ipv6 < 0) {
177- avahi_log_error(__FILE__": Failed to create wide area sockets: %s", strerror(errno));
178-
179- if (e->fd_ipv6 >= 0)
180- close(e->fd_ipv6);
181-
182- if (e->fd_ipv4 >= 0)
183- close(e->fd_ipv4);
184-
185- avahi_free(e);
186- return NULL;
187- }
188-
189- /* Create watches */
190-
191- e->watch_ipv4 = e->watch_ipv6 = NULL;
192-
193- if (e->fd_ipv4 >= 0)
194- e->watch_ipv4 = s->poll_api->watch_new(e->server->poll_api, e->fd_ipv4, AVAHI_WATCH_IN, socket_event, e);
195- if (e->fd_ipv6 >= 0)
196- e->watch_ipv6 = s->poll_api->watch_new(e->server->poll_api, e->fd_ipv6, AVAHI_WATCH_IN, socket_event, e);
197-
198 e->n_dns_servers = e->current_dns_server = 0;
199
200 /* Initialize cache */
201@@ -651,18 +673,6 @@ void avahi_wide_area_engine_free(AvahiWideAreaLookupEngine *e) {
202 avahi_hashmap_free(e->lookups_by_id);
203 avahi_hashmap_free(e->lookups_by_key);
204
205- if (e->watch_ipv4)
206- e->server->poll_api->watch_free(e->watch_ipv4);
207-
208- if (e->watch_ipv6)
209- e->server->poll_api->watch_free(e->watch_ipv6);
210-
211- if (e->fd_ipv6 >= 0)
212- close(e->fd_ipv6);
213-
214- if (e->fd_ipv4 >= 0)
215- close(e->fd_ipv4);
216-
217 avahi_free(e);
218 }
219
220@@ -680,7 +690,7 @@ void avahi_wide_area_set_servers(AvahiWideAreaLookupEngine *e, const AvahiAddres
221
222 if (a) {
223 for (e->n_dns_servers = 0; n > 0 && e->n_dns_servers < AVAHI_WIDE_AREA_SERVERS_MAX; a++, n--)
224- if ((a->proto == AVAHI_PROTO_INET && e->fd_ipv4 >= 0) || (a->proto == AVAHI_PROTO_INET6 && e->fd_ipv6 >= 0))
225+ if (a->proto == AVAHI_PROTO_INET || a->proto == AVAHI_PROTO_INET6)
226 e->dns_servers[e->n_dns_servers++] = *a;
227 } else {
228 assert(n == 0);
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-10-04 04:32:24 +0000